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CHAPTER IX. THE ROLE OF THE BOARD OF DIRECTORS 

General Corporation Law, Del. Code Ann. tit 8, as amended. 5 Delaware statutory and case law, 
however, is supplemental to OFHEO's corporate governance and safety and soundness standards 
that OFHEO has imposed since OFHEO's inception.* 

Well-settled principles of good corporate governance hold that, to be observant of the 
best interests of the corporation, an independent director must "'exercise a healthy skepticism,'" 
and an alertness to possible wrongdoing on the part of corporate insiders." 7 In fact, a director's 
independence should be her "most distinguishing characteristic." 8 That said, in order to be 
effective, a director must do more than simply monitor management's performance. Applicable 
standards require that a director must actively undertake vigorous scrutiny of the corporation's 
affairs, and must be unfailingly vigilant in requiring that management continuously provide an 
adequate and frequent flow of information concerning the goals, objectives, operations, and 
financial condition of the corporation. For efficiency, a board will delegate its oversight work to 
various committees. For example, the audit committee, whose members should be independent 
and free of management influence, 9 is charged with, among other matters, reviewing the internal 
and external audit functions. It does not follow, however, that by delegating certain duties a 
board is absolved of responsibility to ensure that a committee does its work and reports 
adequately on that work. To the contrary, OFHEO* s corporate governance regulation 10 
specifically provides that "no committee shall operate to relieve the board of directors or any 
board member of a responsibility imposed by applicable law, rule, or regulation." 11 In the case 
of Fannie Mae, the Board of Directors imprudently failed to perform those important duties and 
responsibilities, in contravention of myriad applicable safety and soundness standards. 

This chapter chronicles the oversight lapses of Fannie Mae's Board of Directors and, in 
particular, its Audit and Compensation Committees. In short, the Board of Directors failed to be 
sufficiently informed and to act independently of its Chairman, Franklin Raines, and senior 
management The Board failed to exert the requisite oversight over the Enterprise's operations 
and to assure that the Enterprise was fully compliant with applicable law and safety and 
soundness standards. Among the Board's duties was the responsibility to ensure that Fannie 
Mae's financial reporting and disclosures were in accordance with generally accepted accounting 
principles (GAAP). 12 In the absence of policies and procedures adequate to safeguard the 
integrity of the accounting and financial reporting systems, Fannie Mae issued reports of 
condition containing materially false annual and quarterly financial statements, requiring the 



s Fannie Mae complied with the election requirement in 12 C.F.R. § 1710.10(b) by electing to be subject to 
Delaware law for corporate governance purposes, 

6 12 C.F.R. § 1710.30 (b) makes clear that federal law supersedes state law where there is any inconsistency. The 
Federal Housing Enterprises Financial Safety and Soundness Act of 1992, makes clear that OFHEO is primarily in 
charge of assuring the safety and soundness of Fannie Mae. 

7 See Knepper, W. Liability of Corporate Officers and Directors, 1.11, p. 27 (3 rd Ed. 1978) (internal citations 
omitted). 

8 /i,p.26. 

9 The New York Stock Exchange instituted the requirement that all listed public companies have an independent 
audit committee effective June 30, 1978. Id., p. 29. 

,0 As discussed in Chapter III, the corporate governance and safety and soundness regulations promulgated by 
OFHEO capture these essential tenets and provide the analytical framework for assessing the Board's conduct. 

11 12 C.F.R. § 1710.12(a). 

12 Seel2U.S.C.§1723a(]),(k)(l)and(2). 
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restatement of results in prior financial reporting periods in an amount currently estimated at 
$10,6 billion. On the basis of those falsified financial statements, over a period of several years, 
the Chairman, the Chief Financial Officer, and various officers realized sizeable bonuses to 
which they were not entitled. 

Senior management attributed Fannie Mae's unerring ability to hit pre-set earnings per 
share targets, and Wall Street analysts' projections, to its supposedly unique business model. 
That questionable construct went unchallenged by the Board for years. As discussed below, had 
the Board inquired into management's practices with appropriate vigor, many of the problems 
discussed in this report might have been avoided or addressed earlier. 

The Board refrained from demanding accountability from the Chairman and other senior 
executives in numerous ways. Specifically, the Board abandoned its checks-and-balances 
oversight responsibilities; acquiesced in allowing management unbridled authority over its 
agenda, materials, and minutes; did not adopt and impose policies requiring that all critical 
accounting policies and major transactions be vetted before it or its designated committee; and 
acquiesced in allowing the Chairman to concentrate power in the Chief Financial Officer and 
then to seat him on the Board, which enhanced the power and influence of executive Board 
members. In fact, the Board allowed management to determine with little opposition the 
information it received and missed many opportunities for meaningful oversight. 

Among those missed opportunities was the failure on the part of the Board, and the Audit 
Committee in particular, to challenge the Chairman and senior management at several critical 
points during 2003 when the Board should have required a thorough, independent investigation 
into Fannie Mae financial accounting and reporting practices. Those critical points included the 
January 2003 announcement by Freddie Mac, whose business model closely paralleled that of 
Fannie Mae's, that it was restating its financial statements due to misapplications of GAAP and 
initiating an internal investigation; the certification of Fannie Mae's financial statements in 
connection with the registration of its stock effective on March 31, 2003; the management 
shakeup at Freddie Mac in June 2003; the initiation by OFHEO of the special examination in 
July 2003; and the August 2003 allegation by an employee turned whistleblower, that certain 
accounting functions had significantly compromised the validity of the Enterprise's financial 
reporting just prior to the certification of its financial results in connection with its quarterly 
financial report (10Q) for the third quarter of 2003. The Board did not question the fast-tracked 
settlement of the employee's whistleblower claims after management had represented the 
allegations to be unsubstantiated. During the entire period under review, the Board repeatedly 
failed to discharge its responsibilities properly, engaged in conduct contrary to standards of 
prudent operation, and failed to ensure the safe and sound operation of the Enterprise. 

The Board delegated important safety and soundness responsibilities to its committees. 
Of particular importance are the Audit and Compensation Committees. The members of the 
Fannie Mae Board of Directors were all knowledgeable and qualified individuals, fully capable 
of understanding the business and corporate governance issues with which they were charged. 
The chapter proceeds by documenting the responsibilities delegated to the Audit and 
Compensation Committees and the specific safety and soundness failures of those committees. 
The failures of those committees reflect failures of the entire Board of Directors. The following 
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section focuses on failures of the full Board to discharge its oversight responsibilities as 
enumerated in statute, regulation, regulatory guidance, and industry best practice. The members 
of the Fannie Mae Board of Directors failed to stay appropriately informed of corporate strategy; 
review major business decisions; ensure appropriate delegations of authority; ensure that Board 
committees functioned effectively; provide an appropriate check on Chairman and Chief 
Executive Officer (CEO) Franklin Raines; and adequately oversee the risk policies, programs for 
legal and regulatory compliance, hiring and retention of qualified senior executive officers, 
compensation programs, and integrity of accounting and financial reporting systems, including 
independent audits and system of internal control. 

Board Structure and Composition 

To some extent the OFHEO corporate governance regulation allows the Board to rely, in 
directing the Enterprise, on reports from committees. 13 However as detailed later in this chapter, 
that reliance does not relieve Board members of their responsibility to oversee the functioning of 
those committees or of numerous other duties of the full Board. The Board approves Committee 
assignments, including the designation of committee chairs on an annual basis. In 1998, the 
Board had six standing committees: Executive, Assets and Liabilities Policy, Audit, 
Compensation, Nominating and Corporate Governance, and Technology. In December 2003, the 
Technology Committee dissolved and its responsibilities shifted to the Audit Committee. Fannie 
Mae established three new Board committees in 2004: Housing and Community Development, 
Compliance, and Special Review. In 2005, the Assets and Liabilities Policy Committee 
dissolved and the Risk Policy and Capital Committee was established as its replacement. 

Membership on the Fannie Mae Board of Directors was prestigious and provided 

members a high degree of visibility. Mr. Raines was recognized as a top CEO and served as the 
co-chairman of Business Roundtable, a prestigious business group of top executives of nationally 
renowned companies. The Board was comprised of highly knowledgeable and qualified 
individuals with extensive experience on corporate boards of directors, fully capable of 
understanding the business and corporate governance issues with which they were charged. Key 
current members of the Board who served during the period covered by this report include 
current Board Chairman Board Stephen Ashley, who is also Chief Executive Officer of the 
Ashley Group and a former president of the Mortgage Bankers Association. Audit Committee 
Chair Thomas Gerrity is a former Dean of the Wharton School at the University of Pennsylvania. 
Compensation Committee Chair Joe Pickett is the former Chief Executive Officer of Homeside 
International, Inc., and a former president of the Mortgage Bankers Association. Howard 
University President H. Patrick Swygert chairs the Compliance Committee. Housing and 
Community Development Committee Chair Kenneth Duberstein served as White House Chief of 
Staff in the Reagan administration. Former Secretary of Labor Ann McLaughlin Korologos 
chaired Fannie Mae's Nominating and Corporate Governance Committee from 2001 to 2004, 
and currently serves as Chairman of the Board of Trustees of the RAND Corporation. 



13 12 C.F.R. § 1710.11. 

14 Fannie Mae Corporate Governance by-laws: Article 4 at 
http://fanniemae.com/govemance/bv iaws/a^ 

Board-. 



282 



Case 1:06-cv-00139-RJL Document 141-4 Filed 03/15/2007 Page 6 of 24 



CHAPTER IX. THE ROLE OF THE BOARD OF DIRECTORS 

Other key members of the Board that served during the relevant period included Anne 
Mulcahy, Chairman and Chief Executive Officer of Xerox Corporation, and Vincent Mai, 
Chairman and Chief Executive Officer of the private equity firm AEA Investors, LLC, and a 
former managing partner at Lehman Brothers. Both chaired the Compensation Committee 
during their tenure at Fannie Mae. Appendix A provides more detail concerning the composition 
of the Board. 

Between 1998 and 2004, management members of the Fannie Mae Board of Directors 
included James A. Johnson, who served as Chairman and Chief Executive Officer until 

December 1998, and who served as Chair of the Executive Committee until December 1999; 
Lawrence Small, who served as President and Chief Operating Officer until January 2000; 
Franklin Raines, who served as Chairman and Chief Executive Officer-designate from May 1998 
to January 1999, and as Chairman and Chief Executive Officer from January 1999 until 
December 2004; Jamie Gorelick, who served as Vice Chair from May 1997 to May 2003; Daniel 
Mudd, who served as President and Chief Operating Officer from February 2000 until December 
2004, and as President and Chief Executive Officer from December 2004 to the present; and 
Timothy Howard, who served as Vice Chairman and Chief Financial Officer from May 2003 to 
December 2004, Due to his material relationship with Fannie Mae as a consultant for the 
Enterprise, Board member Kenneth Duberstein is considered a non-independent non- 
management director. 

Failures of the Committees of the Board 

The Audit and Compensation Committees, two of the standing committees of the Board of 
Directors, failed to meet regulatory and corporate standards in discharging their responsibilities. 
Of those two, the one with the most far-reaching significance for safety and soundness, both 
because of the required independence of its members and the scope of its responsibilities, was 
the Audit Committee. The failures of the Audit Committee were compounded by failures of the 
Compensation Committee. 

Audit Committee 

As the standards governing the roles, responsibilities and conduct of audit committees have 
evolved over the past two decades, 15 one constant has remained: an audit committee acts under 
the imprimatur of the board of directors pursuant to the delegations of authority and 
responsibilities in its enabling charter and applicable law. Importantly, a board of directors, 
having conferred certain duties upon the audit committee by charter, cannot absolve itself of 
those responsibilities. It follows that any failure by the Audit Committee of the Board of 
Directors of Fannie Mae to adhere to the requisite standards constituted a failure of the Board. 



15 Historically, the standards governing the roles and responsibilities of audit committees evolved in response to a 
rash of well-publicized cases of fraudulent financial reporting. For example, in 1987, the National Commission on 
Fraudulent Financial Reporting (the Treadway Commission) recommended that the boards of directors of all public 

companies be required by Securities Exchange Commission (SEC) rule to establish audit committees composed 
solely of independent directors, and outlined key recommendations for audit committees to follow in carrying out 
their responsibilities. See Louis Braiotta, Jr., The Audit Committee Handbook, Third Edition, 353-354 (1999). 
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Chief among the Board's duties was the responsibility to ensure that Fannie Mae's 
financial reporting and disclosures were in accordance with GAAP, in accordance with the 
Charter Act 16 Of all the Audit Committee's responsibilities — including, for example, the 
oversight of internal and external auditing and internal controls— its principal obligation was to 

ensure the fidelity of Fannie Mae's financial reporting and disclosures. 17 

The Audit Committee failed to protect Fannie Mae's safety and soundness by not 
discharging its duties responsibly and effectively. This section reviews those duties and the 

Committee's failures. 

Applicable Standards 

Audit committees are subject to myriad legal and industry standards, which were published 
throughout the relevant time period, including the 1987 Treadway Commission Report, and two 
studies released in 1999 that called for strengthening an audit committee's role: the so-called 
Blue Ribbon Report 18 and the study commissioned by the Committee of Sponsoring 
Organizations of the Treadway Commission (COSO Report). 19 

Among other matters, the Blue Ribbon Report and the COSO Report called for new audit 
committee disclosure rules and enhanced auditor independence requirements. In response, the 
stock exchanges promulgated revised rules. 20 As an exchange-listed company, Fannie Mae is 
subject to the New York Stock Exchange (NYSE) Listing Standards. Thus, Fannie Mae was 
required to comply with the NYSE rule changes that required audit committees to consist of at 
least three independent directors, each of whom should be able to read and understand 
fundamental financial statements, and one of whom should have accounting or financial 
expertise. 21 The NYSE also outlined requirements of independence and required the adoption of 
a formal written charter. 22 



16 See 12 U.S.C. § 1723a(l), (k)(l) and (2). 

17 "Audit committees also help the Board [of Directors] by overseeing the conduct and performance of 
management with respect to the preparation of the company's financial statements and financial disclosures." See 
Fenwick & West LLP, "Audit Committee Duties and Best Practices" (March 21, 2002). p. 2. 

18 In 1999, the role of audit committees was revitalized and strengthened by the "Report and Recommendations of 
the Blue Ribbon Committee on Improving the Effectiveness of Corporate Audit Committees," February 8, 1999, 
(Blue Ribbon Report). The Blue Ribbon Report outlined ten specific regulatory changes regarding audit committees 
and five guiding principles for audit committees to follow when developing their own policies. 

19 See 'The COSO Report, Fraudulent Financial Reporting: 1987-1997, An analysis of U.S. .Public Companies, 
Commissioned by the Committee of Sponsoring Organizations of the Treadway Commission," March 1999. The 
COSO Report identified and analyzed instances of alleged fraudulent financial reporting by companies investigated 
by the commission in the ten-year period following the 19S7 Treadway Commission Report and highlighted the 
need for independent and effective audit committee oversight. 

20 See NYSE, Nasdaq and AMEX, Audit Committee Rule Requirements, September 20, 1999. Those proposed 
rule changes were approved by the SEC on December 14, 1999. Securities Exchange Act Release Nos. 34-41, 980- 
982, October 6 and 13, 1999, 

21 See NYSE Audit Committee Rule 303.01(B)(2), September 20, 1999. The rule was approved by the SEC on 
Dec. 14, 1999. 

22 See NYSE Audit Committee Rule 303.01(B)(1), September 20, 1999. The rule was approved by the SEC on 
Dec. 14, 1999. 
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Both the SEC and the NYSE again proposed new standards to further strengthen audit 

committees 23 in response to the enactment of the Sarbanes-Oxley Act (SOX) in 2002, 24 which 
effectively federalized the role of the public company audit committee. SOX focused more 
attention on the need for independent oversight by increasing audit committee responsibilities 
and authority, and by raising committee membership requirements to include a greater number of 
independent directors. 25 

As discussed below, Fannie Mae's Board revised the Charter of the Audit Committee as 
new standards proliferated. For example, in early 2000, in response to the newly elucidated 1999 
standards, the Board amended the 1996 Audit Committee Charter. The Board again revised the 
charter in 2003. That those charter revisions were undertaken is not in question; the issue, rather, 
is whether the Audit Committee complied with them. 

In 1998, the responsibilities of the Audit Committee of the Board were set forth in the 
Audit Committee Charter adopted in 1996. 2fi The 1996 Charter delineates the Audit 
Committee's oversight responsibilities with respect to regulatory compliance, accounting and 
financial reporting, the external auditor relationship, and internal auditing activities. Among 
other things, the 1996 Charter required the Audit Committee to: 

• Meet with management, internal auditors, and the corporation's independent 
auditors, and to develop in-depth and specialized knowledge on matters 
relating to corporate accounting, financial reporting, internal control, auditing, 

and regulatory compliance activities; 

• Review and make recommendations to the Board on the corporation's 
accounting and financial reporting practices and its annual financial report to 

shareholders; 

• Assess the adequacy and effectiveness of internal controls, including 
compliance with established limits on derivatives risk; 

• Receive periodic reports from management, internal audit, and the 
corporation's independent auditors on matters relating to corporate 
accounting, financial reporting, internal control, auditing, and regulatory 
compliance, and on the activities of management's Business Conduct 
Committee, including monitoring compliance with the Code of Business 
Conduct; and 

• Recommend to the Board the appointment of the corporation's independent 
auditors and oversee the activities of the independent auditors. 



23 Securities Exchange Release No. 34-48,745, November 4, 2003 . 

24 Sarbanes-Oxley Act of 2002, Pub, L. No, 107-204, § 407, 116 Stat. 745, 790 (2002). 

25 Annemarie K. Keinath and Judith C. Waio, "Audit Committee Responsibilities: Focusing on Oversight, Open 
Communication, and Best Practices," The CPA Journal, November 2004. 

26 The Audit Committee Charter, November 19, 1996, was included in the Audit Committee Meeting Package, as 
part of the of the April 21, 199S, committee meeting minutes. 
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The Charter seemingly limited some of the Committee's authority by requiring the Audit 

Committee Chair to consult with executive management in overseeing and evaluating the 
activities and performance of the "Vice President for Auditing," and "the budgets and staffing of 
the internal audit department." Additionally, the Charter authorized the Audit Committee to 
"cause an investigation to be made" into any matter under its scope of responsibility that "is 
brought to its attention." The Charter later underwent wholesale revisions. 

In 2000, the Audit Committee Charter revised the responsibilities of the Audit Committee 
members to include monitoring the integrity of the corporation's financial statements and the 
independence of internal and external audit functions. 27 The 2000 Charter further required the 
Audit Committee to review the corporation's financial reporting practices, including the 
significant issues and judgments made in connection with the preparation of the audited financial 
statements, and to receive periodic reports relating to the corporation's business environment, 
major risks, and risk management processes. Additionally, the importance of independent 
communication flow was emphasized. Again, the Charter provided authority for the Committee 
to "cause an investigation to be made into any matter within the scope of its responsibility that is 
brought to its attention " Here, the Committee's authority was expanded to permit it to "engage 
such independent resources to assist in its investigations, as it deems necessary." Thus, the 
Committee had mil authority to initiate an investigation into any matter under its purview. 

The Charter was again restructured in 2003 28 in conjunction with Fannie Mae's first 
proxy statement to shareholders upon SEC registration. At that time, the charter was amended to 
include the responsibilities of audit committees required by the Sarbanes-Oxley Act of 2002. 
The 2003 Charter clarified the Committee's responsibility to monitor independence of the 
internal audit function by requiring that the Committee ensure that no limitations or restrictions 
were placed on that function. 

In addition to maintaining the pre-existing oversight responsibilities, the 2003 Charter 
also provided for heightened financial statement and disclosure responsibilities, including: 

• A discussion and analysis of the outside auditor's judgment as to the quality 
of the corporation's accounting principles, significant financial reporting 

issues, and MD&A [Management Discussion and Analysis] disclosures; 

• Review and discuss with the outside auditors all critical accounting policies, 

any alternative treatments under GAAP, and material communications with 
management; and 

• Review and discuss with management and the outside auditor any 
correspondence with regulators or governmental agencies which raises 

material issues regarding Fannie Mae's financial statements, financial 
disclosures or accounting policies. 



27 See Audit Committee Charter, July 1 8, 2000, at FMSE 014495-97. 

28 See 2003 Audit Committee Charter included in the Audit Committee Meeting minutes of January 21, 2003. 
FMSE 504223-228. 
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Failures of the Audit Committee 

The Audit Committee of the Board of Directors failed to safeguard Fannie Mae's safety and 
soundness by not discharging its duties responsibly and effectively. Specifically, the Committee 
failed to evaluate the internal audit function and the performance of the head of the Office of 
Auditing, to oversee the production of financial statements, to monitor the development and 
implementation of critical accounting policies, to develop in-depth or specialized knowledge 
necessary to its oversight responsibilities, and to oversee adequately the work of the external 
auditor. 

The Audit Committee was complacent in the oversight activities required by its Charter 
and applicable regulations, guidelines, and standards. Members of the Audit Committee 
exercised little, if any, meaningful or active oversight. They failed to perform disciplined and 
consistent evaluations of internal audit activities, to probe management of the Office of Auditing, 
or to discuss diligently or inquire adequately with respect to incomplete representations of 
management and the Office of Auditing regarding critical accounting issues. Those issues 
included whether critical accounting policies conformed with GAAP and the uncorroborated 
representations of management that the external auditor reviewed and approved those policies. 
The record fails to demonstrate adequate inquiry or thoughtful requests for additional 
information or explanation from Audit Committee members in their meetings with the external 
auditor. 

The Audit Committee was required to develop in-depth and specialized knowledge on 
matters relating to corporate accounting and financial reporting in order to serve its oversight 
role effectively. That role encompassed oversight of both the internal and external auditor 
relationships as well as responsibility for monitoring the integrity of the Fannie Mae's financial 
statements. Further, standards during the relevant time period as developed by the Treadway 
Commission (1987), The Blue Ribbon Commission (1999) and the SEC (1999, 2000, and 2002) 
required audit committees to engage in vigilant and effective oversight of the Enterprise's 
financial reporting process and internal controls. 

In February 2001, after the Blue Ribbon Report and resulting changes in SEC and NYSE 
standards, Sampath Rajappa, Senior Vice President for Operations Risk and head of the Office of 
Auditing, reported to Vice-Chairman Jamie Gorelick, Chairman and CEO Franklin Raines, CFO 
Timothy Howard, Controller Leanne Spencer, and others that he would address with KPMG how 
Fannie Mae would "meet all the foregoing requirements at the Audit Committee meeting." 29 
Mr. Rajappa also claimed that M [i]n a nutshell, we are/will be in compliance with all the 
requirements.'* The requirements to which he referred included American Institute of Certified 
Public Accountants Statements of Auditing Standards SAS-89 and SAS-90, the NYSE's 
guidelines on audit committee governance standards, the SEC Final Rules on audit committee 
requirements, and the SEC independence rules as they pertained to the external auditor. At the 



29 



E-mail chain from Sampath Rajappa to Jamie Gorelick with a copy to Franklin Raines, Timothy Howard, 
Leanne Spencer and others, "Re: Audit Committee Requirements,'* February 12, 2001, FMSE-KD 016986-88 (in 
which Mr. Rajappa reported that "KPMG and I will address how we meet all the requirements at the audit 
committee on Feb. 20.") 
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Audit Committee meeting on February 20, 2001, Mr. Rajappa and Ms. Theobald, of KPMG, 
reported that the Audit Committee either met or exceeded every requirement. 30,31 

In 2002, Fannie Mae Board policies and practices were reviewed with the goal of 
ensuring that Fannie Mae corporate governance was "best in class,'* 32 That review included an 
assessment of Fannie Mae's corporate governance policies and practices against the standards 
contained in SOX, NYSE listing requirements, OFHEO and SEC regulations, and best' 
practices. 33 In early 2003, the Fannie Mae Board of Directors adopted a variety of enhancements 
to achieve "best in class" status. 34 Despite those representations and Fannie Mae's desire to be 
"best in class," both the Audit Committee and its chairman failed to comply with the Audit 
Committee Charter and professional standards. 

Failure to Oversee the Office of Auditing and the Head of the Office of Auditing. The Audit 
Committee's responsibilities include oversight of both the internal and external audit functions 
independent of management Effective execution of fiduciary duty and responsibility requires 
robust oversight and involvement, including candid discussions, diligent and knowledgeable 
committee membership, and the use of external consultants as authorized by the Audit 
Committee Charter. 35 

According to its charter, the Audit Committee has the express duty to oversee the internal 
audit function, which at Fannie Mae was conducted by the Office of Auditing.^ In that capacity, 
the Audit Committee is responsible for discussing Office of Auditing activities, including the 
appointment and replacement of its head, and its budget and staffing. The Audit Committee is 
also charged with determining the scope and performance of the internal audit function, 
reviewing the Audit Plan, and ascertaining whether there are any restrictions or limitations on the 
Office. In order to fulfill its duty, the Audit Committee also has the responsibility of obtaining 
periodic reports from the head of the Office regarding the findings of internal audits. 



30 See Audit Committee Meeting Minutes of February 20, 2001, FMSE 014870-014876 at 73. 

31 While Mr. Rajappa, Senior Vice President for Operations Risk and head of the Office of Auditing, was reporting 
that Fannie Mae is or will be in compliance with all the requirements, including independent communication and 
information flow between audit committee and internal audit and external audit as well as candid discussions with 
management and external auditors, he also indicates that he " will meet with KPMG on Wednesday to go over their 
exact talking points. , ." and represents to already know "what they (KPMG) intend to say " See e-mail chain from 
Sampath Rajappa to Jamie Goreltck with a copy to Franklin Raines, Timothy Howard, Leanne Spencer, and others, 
w Re: Audit Committee Requirements," February 12, 2001 , FMSE-KD 16986. 

32 See Minutes of the Meeting of the Nominating and Corporate Governance Committee of the Board of Directors 
of Fannie Mae, July 1 6, 2002, FMSE 505365-66, at FMSE 505365. 

33 See Minutes of the Meeting of the Nominating and Corporate Governance Committee of the Board of Directors 
of Fannie Mae, July 16, 2002, FMSE 505365-66, at FMSE 505365; Fannie Mae Corporate . Governance 
Benchmarking Project: Issues for Consideration dated Aug. 6, 2002, FMSE 12859-87. 

34 See Minutes of the Meeting of the Board of Directors of Fannie Mae, January 21, 2003, FMSE 504202-40, at 
FMSE 504220-21. See also Draft Working Scorecard for Benchmarking Project, January 16, 2003, FMSE 13512- 
16. 

35 E-mail chain from Sampath Rajappa to Jamie Gorelick with copies to Franklin Raines, Timothy Howard, Leanne 
Spencer, et ai, "Re: Audit Committee Requirements," February 12, 2001; Mr. Rajappa submits the five guiding 
principles for Audit Committee best practices from the SEC's chief accountant, including "robust oversight" of 
management and diligent and knowledgeable committee membership, FMSE-KD 016986-88, at 016987. 
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The Audit Committee failed to execute its oversight responsibilities adequately. Those 
failures primarily involved a lack of appropriate concern for safeguarding the independence of 
the internal audit function from financial reporting and business functions, and a lack of 

engagement in the planning and evaluation of internal audits. 

The Appointment of Mr. Rajappa, While the Board has the overall responsibility for hiring 
qualified senior officers, 36 the Audit Committee Charter placed the responsibility for hiring and 
firing of the head of the Office of Auditing on the Audit Committee. In addition to conducting a 

thorough evaluation of the qualifications and credentials of a candidate, the Audit Committee 
was responsible for ensuring that the appointment in no way jeopardized the independence of the 
internal audit function. 

As described in Chapter VIII, since Mr. Rajappa served as Fannie Mae Controller 
directly before his appointment to head the Office of Auditing, his appointment put him in the 
inappropriate position of auditing his own work. As Controller, Mr. Rajappa was involved in 
accounting analysis and decisions related to the entire financial operations of Fannie Mae, 
including Manufactured Housing, Loan Loss Reserves, REMICS, Purchase Premium and 
Discount Amortization, interest-only securities, impairment and mark-to-market rules, Synthetic 
MBS, and low-income housing tax credits. Many of those areas will be subject to restatement or 
have been identified as not in compliance with GAAP. 

No discussion of Mr. Rajappa's new position as head of the Office of Auditing appears in 
the minutes of either the January 19, 1999, Board of Directors meeting or the minutes of the 
February 16, 1999 Audit Committee meeting. OFHEO found no other evidence of a critical 
evaluation of the sufficiency of Mr. Rajappa's education, training, experience (for example, the 
fact that he was not a certified public accountant), or his ability to oversee the internal audit 
function objectively, given his former position as Controller. Effective, diligent oversight in 
compliance with the Audit Committee Charter clearly required such a discussion. 

When questioned during the OFHEO examination, Mr. Gerrity, the then newly-appointed 
Audit Committee Chairman, stated that he could not recall specifically whether Ms. Spencer had 

assumed the position of Controller by the January 1999 board meeting, nor did Mr. Gerriry know 
why Mr. Rajappa was selected to be the head of the Office of Auditing. 37 Mr. Gerriry also stated 
that he did not think it was awkward that Mr. Rajappa was formerly the Controller. 8 The Audit 
Committee clearly was aware of Mr. Rajappa's prior experience as Controller and had a 
responsibility to ensure there were no known independence violations or conflicts of interest 
Instead, the Audit Committee stood silent as the Office of Auditing, under Mr. Rajappa's 
supervision, conducted audits of his former department. 39 The Audit Committee did not meet its 
responsibility to question, if not challenge, the appointment of Mr. Rajappa, At a minimum, the 
Audit Committee should have required Mr. Rajappa to recuse himself from any review function 
inconsistent with the Institute of Internal Auditors standards discussed in Chapter VIL 



36 Title 12 C.F.R. 1710. 15(b(2) 

37 Paul Weiss memorandum of interview with Thomas Gerrity, February 28, 2006, FM SRC OFHEO 00713198- 
218, at 00713203, 

38 OFHEO Interview, Thomas Gerrity, February 28, 2006, p. 87. 

39 OFHEO Interview, Sampath Rajappa, February 23, 2006, p. 13. 
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Inappropriate Compensation of Office of Auditing Staff, As discussed in Chapters VII and VIII, 
compensating senior internal auditors on an EPS-basis creates a problem at least as to the 
appearance of independence — a problem that was exacerbated by Mr, Rajappa's enthusiasm for 
EPS compensation. Although the Compensation Committee was directly responsible for setting 
bonuses, the Audit Committee was responsible for insuring the independence and objectivity of 
the internal audit function. That responsibility required the Committee to consider the 
independence and objectivity issues created by tying the compensation of the staff of the Office 
of Auditing to EPS, given the independent oversight role of that office. The Audit Committee's 
failure to address the inherent conflict of interest created by that compensation ultimately 
contributed to the inappropriate admonitions of Mr. Rajappa to his staff members to "live, 
breathe and dream 6.46" and that they should become "obsessed" with seeing to it that they did 
their part to help Fannie Mae achieve the EPS goal. 40 As evidenced by that communication and 
supported by a recommendation in Ernst and Young's report dated June 30, 2005 on Internal 
Audit Transformation-Recommendations, 41 the Audit Committee should have considered and 
recommended that an alternate method to determine incentive compensation be applied to 
Internal Audit. 42 

Other Issues Concerning the Independence of the Office of Auditing. Internal audit best practices 
require that "[t]he internal auditors* qualifications, staff, status within the company, reporting 
lines, [and] relationship with the audit committee of the board of directors must be adequate to 
ensure the internal audit function's effectiveness and objectivity...." 43 In order to fulfill its duty 
to oversee the internal audit function, the Audit Committee has a responsibility to ensure that the 
independence of the internal audit function is not jeopardized, either in appearance or fact. The 
Office of Auditing was supposed to be a direct report to the Audit Committee, with an 
administrative or "dotted-line" report to management. In practice those relationships appear to 
have been reversed. 

In 2002, the "dotted line" reporting for the head of the Office of Auditing, Mr. Rajappa, 
moved from COO Mudd to CFO Howard. 44 According to Mr. Rajappa, CEO Raines made the 
decision that the reporting line should shift to the CFO. That reporting structure had the 
potential to jeopardize independence and should have been vetted through the appropriate 
channels, i.e., the Audit Committee. The minutes do not show that the Audit Committee 
addressed the issue. However, Mr. Rajappa recalled that Audit Committee Chair Gerrity 
approved of the change without discussing the issue with him. Thereafter, Mr, Rajappa recalls 
expressing his reservations regarding the reporting shift to Mr. Gerrity. 



40 See Sampath Rajappa's address to Audit Group on "what we can do to help achieve $6,46 EPS/' FM SRC 
OFHEO 00142373-74. 

41 See Ernst and Young report, "Fannie Mae Office of Auditing, Internal Audit Transformation - 
Recommendations," June 30, 2005, FMSE 510811 - 510833. 

42 Id, Also see "Report to the Board Compensation Committee on Appropriate Corporation Structure and 
Incentives for Fannie Mae Management," February 23, 2005, which recommended that bonus compensation for 
the head of Internal Audit should not be tied to earnings, FMSE-EC 008826 - 008992, at 909 and 947. 

43 Report of National Commission on Fraudulent Financial Reporting, (Treadway Commission), p. 11 . 

44 Paul Weiss memorandum of interview with Sampath Rajappa, January 19, 2005, FM SRC OFHEO 00227300- 
306 at 302. That page of that memorandum is the source for this and the following paragraph. 
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Mr. Rajappa questioned whether placing the head of the Office of Auditing under the 
CFO was appropriate from a best practices perspective. He raised those concerns with Mr. 
Howard who, according to Mr. Rajappa, claims to have unsuccessfully attempted to coordinate a 
discussion with Mr. Raines on the topic. As Controller, Mr. Rajappa had served as a direct 
report to Mr. Howard. Review of the integrity of financial information is among the core 
functions of the Office of Auditing, and Mr. Howard's direct reports (and, ultimately, Mr. 
Howard) were responsible for the development of accounting policy. Considering those facts, it 
is easy to understand why Mr. Rajappa was concerned with having the head of the Office of 
Auditing report to the CFO. 

Mr. Gerrity's insensitivity to any perceived or actual breach of independence is 
evidenced by his failure to conduct any evaluation of the change in reporting or to discuss it with 
the Audit Committee as a whole. As a result of the inaction of the Audit Committee and the 
concomitant lack of clear guidelines, Mr. Howard was in a position to exert inappropriate 
influence on the Office of Auditing. 45 The Audit Committee's failure was further compounded 
during the annual review process. The Audit Committee Charter dictates that the Audit 
Committee is jointly responsible for the budget and staffing of the Office of Auditing. However, 
Mr. Rajappa' s performance evaluations were written and presented by his supervisors — COO 
Small, COO Mudd, and ultimately, CFO Howard— with input from Mr. Gerrity. 46 Those 
evaluations were the basis for salary increases and bonuses. Mr. Gerrity's involvement in the 
process appears to have been a limited review of the evaluation prepared by Mr. Howard. 

The Scope of Internal Audits. The Audit Committee was directed by the Audit Committee 
Charter to establish the scope and evaluate the performance of the internal audit function. On an 
annual basis, the Office of Auditing developed its Audit Plan, which was vetted with the Audit 
Committee. That Audit Plan identified key risks and established audit priorities. Effective 
interaction between the Office and the Audit Committee regarding the Audit Plan was paramount 
to the development of an effective oversight mechanism. The Audit Committee expected the 
Office of Auditing to audit accounting and financial reporting areas for GAAP compliance 
because those internal audit reports indicated as much. However, as documented in Chapter VII, 
a communication gap existed between expectations of the Audit Committee and the practices of 
the Office of Auditing regarding the scope of the reviews. For example, Mr. Rajappa and others 
in the Office of Auditing have stated that testing for GAAP compliance was not within their 
mandate. Mr. Gerrity, on the other hand, indicated that the Office of Auditing was to serve as a 
"watchdog" for GAAP compliance in addition to the external auditor. 48 His understanding was 
based on his belief that the Office of Auditing understood GAAP and that noncompliance with 
GAAP would represent a material weakness. That fundamental misunderstanding existed for 



45 E-mail from Timothy Howard to Leanne Spencer, "FW: Fannie Scolded for Obsolete Accounting Systems,** 
March 3, 2004, OFH-FNM00126929. In that e-mail, Mr. Howard informed Ms. Spencer that he had made It 
"blisteringly clear*' to Mr. Rajappa that the latter was to run all Audit Committee issues by him before going to the 
Audit Committee Chair. 

46 Paul Weiss memorandum of interview with Sampath Rajappa, January 19, 2005, FM SRC OFHEO 00227300- 
306 at 302. 

47 OFHEO Interview, Thomas Gerrity, February 28, 2006, p. 46. 

48 OFHEO Interview, Thomas Gerrity, February 28, 2006, p. 1 1 . 

49 OFHEO Interview, Thomas Gerrity, February 28, 2006 , p. 101 
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five years, illustrating the lack of communication between the Audit Committee and the Office 
of Auditing as well as a lack of the robust oversight that applicable standards require. 50 

Lack of Timely Internal Audits of Critical Accounting Policies. In April of each year, the Audit 
Committee was responsible for approving the Audit Plan. That plan was developed as a 
roadmap for audit activities and was based on an assessment of critical policies and key control 
areas. 51 The process of establishing priorities was a function of both the inherent risk of the 
activity as well as the results of prior audit activities in the respective areas. As described later in 
this chapter, audit areas were color coded through that process. "Red" audits areas would be 
reviewed annually, whereas activities deemed "green" would only be examined every three 
years. 52 The Audit Committee was involved in the process and specifically requested that the 
Office of Auditing perform an annual review of the accounting for derivatives. 5 Despite audit 
differences in 1998 and 1999, and after being told by KPMG, in relation to the 1998 audit that a 
written policy was an absolute necessity, Fannie Mae waited until 2003 to conduct its first 
substantive review of the implementation of the FAS 91 policy formalized in December 2000. 
Given that FAS 91 was a critical accounting estimate (as discussed in Chapter VII) and given the 
magnitude of the reporting errors that could — and did — result from an improper application of 
FAS 91, the Office of Auditing should have deemed the review of that policy a high audit 
priority. In the absence of initiative from the Office of Auditing, it was incumbent upon the 
Audit Committee to require an audit to be done on a more urgent basis prior to 2003. 

Failure to Make Adequate Inquiries. Although the Board has the overall responsibility of 
assuring the integrity of Fannie Mae's accounting and financial reporting systems, 55 the Audit 
Committee is charged with the specific responsibility of overseeing "the accounting, reporting, 
and financial practices of the corporation and its subsidiaries, including the integrity of the 
corporation's financial statements. . . ." Gaining knowledge and making the appropriate 
inquiries are critical components of any oversight function. Early versions of the Charter even 
contained an explicit requirement that the Audit Committee "develop in depth and specialized 
knowledge on matters relating to the Committee's responsibilities . . ." Despite that directive, 
Mr. Gerrity was aware of neither how Fannie Mae formulated its accounting policies, nor who 
was responsible for them. 56 Also, as described in detail below, the Audit Committee failed to 
exhibit an appropriate level of knowledge about several of Fannie Mae's significant accounting 
policies, such as those related to FAS 91 and the allowance for losses. Furthermore, Mr. Gerrity 
stated that he "would count on management and/or Internal Audit and/or KPMG to raise [FAS 
91, FAS 133, or other FAS issues with the committee]. That's the only way in which we would 



50 See Audit Committee Certification of FAS 133, FMSE 014893, FMSE 0153 16, FMSE 016125. 

51 OFHEO Interview, Sampath Rajappa, June 17, 2004, pp. 14-16. 

52 OFHEO Interview, Sampath Rajappa, June 17, 2004, pp. 14-16. 

53 OFHEO Interview, Sampath Rajappa, February 23, 2006, p. 85. 

5 " Mr, Gerrity apparently never read Fannie Mae's "Purchase Premium and Discount Amortization Policy" as he 
had no recollection of seeing the written policy and only learned of the major provisions "in the last year or so." 
OFHEO Interview, Thomas Gerrity, March 14, 2006, p. 77. 

55 12 C.F.R. 1710.15(b)(4). 

56 Paul Weiss memorandum of interview with Thomas Gerrity, February 21, 2005, FM SRC OFHEO 00713198- 
3218. 
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know/' 57 This passive approach to gaining knowledge of critical accounting policies 

contravenes all applicable governance standards. 

Low-Income Housing Tax Credits (LIHTC) Accounting. As detailed in Chapter VI, Fannie Mae 
realized a one-time earnings-per-share (EPS) benefit of $0.10 ($108.1 million) 58 as a result of a 
change in the method of accounting for the Enterprise's investments in low income housing tax 
credits (LIHTC) from a non-GAAP to a GAAP method. Without the LIHTC, Fannie Mae would 
not have met analysts' expectations or the EPS targets required for executives to receive the 
maximum AIP bonuses for 1998. 

Considering that LIHTC represented a one-time benefit which resulted from a change 
made late in the fourth quarter that enabled Fannie Mae to pay out bonuses and meet Wall Street 
expectations, the Audit Committee members had an oversight-related duty to obtain additional 
information. Neither the Audit Committee nor the broader Board sought additional information 
regarding that accounting change, nor did they question the effect on reported EPS and thus AIP 
and long-term compensation payouts to executives. Considering that KPMG identified that issue 
as an area of disagreement in the Q4 1998 completion memo, s9 a reasonable inquiry to 
management and the external auditor would likely have yielded some clarity as to the 
components of the benefit. At a minimum, the Audit Committee would have received additional 
information regarding the magnitude of the EPS effect. As the change in LIHTC accounting 
materially affected reported EPS, the Audit Committee should have communicated the one-time 
nature of the change to the Compensation Committee to determine whether non-recurring or 
"poor quality" earnings should have had a negative impact on EPS bonus calculations. Mr. Mai, 
as a member of both the Audit Committee and Chair of the Compensation Committee, should 
have been particularly sensitive to the significance of EPS in terms of management 
compensation, By failing to make the appropriate inquiries regarding the nature of the change, 
the Audit Committee failed in its oversight role. 

Allowance for Loan Loss Accounting, During the period covered by this report, Fannie Mae 
identified its treatment of the allowance for loan losses as a significant accounting policy. The 
practice of over-reserving for the purpose of establishing an earnings "cookie jar" had been 
identified by Arthur Levitt and others as fertile ground for earnings management abuses. 
Therefore, the Audit Committee had a responsibility to gain sufficient knowledge of Fannie 
Mae's policy in order to evaluate the appropriateness of its application. Had the Committee 
members made the appropriate inquiries or conducted a review of the financial statements, they 
would have noticed that the level of the reserve stood essentially unchanged at approximately 
$800 million for the period 1997 through 2003. 61 In January 1999, CFO Howard presented the 
result of operations for 1998 to the Fannie Mae Board of Directors. 62 Mr. Howard told the 



S7 OFHEO Interview, Thomas Gerrity, March 14, 2006, p. 34, 

5? $ 108.1 million divided by 1 ,037 million shares outstanding resulted in an EPS Impact of 10.5£. 

59 See Fannie Mae Fourth Quarter Completion Memo, December 31,1 998, KPMG-OFHEO-063945. 

60 See Fannie Mae Annual Report 1998, p. 44. 

61 Mr. Gernfy stated that he did not even believe that loan loss reserves were considered "critical accounting 
policies" at Fannie Mae. OFHEO Interview, Thomas Gerrity, February 28, 2006, p. 75. 

62 See Notes for January 19, 1999, Board of Directors Meeting, FM SRC OFHEO 00310536-41 at FM SRC 
OFHEO 00310536-39. 



293 



Case 1:06-cv-00139-RJL Document 141-4 Filed 03/1 5/2007 Page 17 of 24 



CHAPTER IX. THE ROLE OF THE BOARD OF DIRECTORS 

Board that the swing from a credit loss position to net recoveries allowed the company to record 
a negative provision for losses of $50 million (another of the adjustments that allowed Fannie 
Mae to reach its maximum EPS target in 1998); however, outstanding allowance for future losses 
stayed the same. Mr. Howard even highlighted the size of the reserve to the investment 
community in a conference call related to 1998 earnings, stating that even though the amount 
seemed conservative, Fannie Mae intended to hold the level at $800 million dollars until the 
Enterprise got a better sense of where iong-term trends settled out. 63 The Audit Committee 
failed to discharge its financial oversight responsibilities by not inquiring further regarding the 
amount of the reserve and not following up in subsequent years as the amount remained 
unchanged. 

As detailed in Chapter VI, Fannie Mae methodology for recording adjustments to the 
reserve did not conform with GAAP, Controller Leanne Spencer explained to the Audit 
Committee at the February 20, 2001 meeting that the current methodology for recording charge- 
offs and recoveries was not the "preferable" accounting treatment. Additionally, she indicated 
that she. would be investigating whether a change in accounting was appropriate. 64 The minutes 
of the Audit Committee do not reflect any inquiries regarding the appropriateness of the absolute 
level of the loss reserve despite a 27 percent decrease in the dollar value of credit losses in 2000 
to the lowest level since 1984, when Fannie Mae's portfolio was one-tenth the current size. 
Neither does the record reflect any questions from members of the Committee regarding the 
possible accounting change. Ms. Spencer again addressed the issue in February 2002, informing 
the Audit Committee of an "alternative method" to reclassify recoveries. 65 

Fannie Mae did not elect to change its accounting treatment until 2003, Audit Committee 
meeting minutes do not reflect that the Committee sought more information regarding the 
necessity for a change or followed up to establish why the change was not implemented for fiscal 
year 2001. The Audit Committee appears not to have asked either management or the external 
auditor about the magnitude of the reserve. 

''Yellow" Audit Reports. The Office of Auditing color-coded their audits according to 
importance, with "red" identifying audits with significant issues that required immediate 
attention. "Yellow" identified audits where controls needed strengthening and corrective action 
would be taken during the normal course of business, generally 18 to 24 months, according to 
Mr. Rajappa. 66 "Green" identified audits that were fairly clean, with issues that could be 
resolved quickly, 67 "Red" audits were reported to the Office of the Chairman and to the Audit 
Committee, 68 placed on the Audit Tracking List (ATL), and reviewed. That methodology was 
utilized in order to prioritize follow-up work and assist in the development of the audit plan. 



63 See Notes for January 1 4, 1 999, Conference Call, p.4, FM SRC OFHEO 0340 16-19. 

64 There is significant similarity between Ms. Spencer's scheduled presentation, including a modified handwritten 
script, and the Audit Committee Minutes of February 20, 2001, concerning credit Josses, charge-offs, and recoveries. 
See minutes at FMSE 014869-76 and Ms. Spencer's notes within The Year in Review Presentation, FMSE 367220- 
36, at FMSE 367227-28. 

6i See Audit Committee Minutes, February 19, 2002, p. 3 FMSE 015292. 

66 OFHEO Interview, Sampath Rajappa, June 17, 2004, p. 15, 

67 Id. 

68 OFHEO Interview, Thomas Gerrity, February 28, 2006, pp. 27-28. 

69 See Fannie Mae Office of Auditing Audit Manual at FNM 00100541 at p.C-3 ,2-3.3. 
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According to Mr. Rajappa, "yellow" audits would go only to the Chairman of Fannie Mae and 
the Office of the Chairman but not to the Audit Committee. 70 

Several of the "yellow" issues were significant in and of themselves. In fact, with respect 
to the Amortization Audit dated July 9, 2003, Ann Eiiers, Director for Accounting and Audit, 

indicated that the audit rating was "yellow" simply because management assured the Office of 
Auditing that they were working on the problem. 71 As a result, management was able to 

circumvent Audit Committee review. 

In order to provide effective oversight of the control environment, the Audit Committee 
must have a reasonable understanding of the depth and breadth of internal control deficiencies. 
Simply reviewing the most egregious control failures did not provide the Audit Committee with 
that knowledge. For example, key-person dependencies and poor documentation might not raise 

a red flag in an isolated incident; however, a pattern of undocumented decisions (which existed) 
highlights a more significant breach of internal controls. The Audit Committee should have had 
a mechanism in place to understand the scope of internal control problems and management's 
efforts to address those problems. The significant lack of oversight by the Audit Committee 
enabled the Office of Auditing to conduct audits and issue findings with less than appropriate 
scrutiny. 

Failure to Oversee the Development and Implementation of Critical Accounting Policies. 
Previous chapters have established that accounting policies and estimates that Fannie Mae 
designated as critical failed to comply with GAAP. In particular, those related to the amortization 
of purchase premiums and discounts (FAS 91) and accounting for derivatives and hedging 
activities (FAS 133). The Audit Committee failed in its responsibility to understand and ensure 
that appropriate application of critical accounting policies was occurring, as outlined by the 
Audit Committee charter as well as in standards previously discussed, despite the requirements 
that audit committees be informed, vigilant, and effective overseers of the financial reporting 
process and the company's internal controls. 

FAS 91. The Fannie Mae Audit Committee did not actively monitor the critical policy of 
accounting for the amortization of discounts and premiums. The Audit Committee failed to 
address the implications of the 1998 FAS 91 audit adjustments, and systems control issues that 
were brought to the attention of Audit Committee Chair Gerrity in early 1999. Audit 
adjustments are proposed corrections identified through the external audit process. Prior to the 
issuance of Statement on Auditing Standards (SAS) 89 effective December 1999, there was no 
requirement that an external auditor inform the Audit Committee of those adjustments deemed 
immaterial. Following SAS 89, the external auditor was required to notify the Audit Committee 
of all audit differences, whether or not materia!. 72 As detailed in Chapter VI, KPMG identified 



70 OFHEO Interview, Sampath Rajappa, February 23, 2006, pp. 81-82; Mr. Gerrity confirmed that the Audit 

Committee did not review the yellow audits. OFHEO Interview, Thomas Gerrity, February 28, 2006, p. 33. 

7J OFHEO Interview, Ann Eiiers, July 23, 2004, p. 242. Since the Audit Committee only received reports on 'red' 

audits, changing the color to "yellow" by promising timely resolution was an easy means to avoid Audit Committee 

scrutiny. 

72 Under SAS 89, the externa! auditor is ". . .required to inform the audit committee about uncorrected 

misstatements aggregated by the auditor during the current engagement and pertaining to the latest period presented 
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an audit difference of $200 million related to FAS 91, the amortization of premiums and 
discounts, in 1998. As part of the year-end audit work, KPMG met with Audit Committee 
Chairman Gerrity in early 1999 and advised him of that audit difference and how it arose and 
that the FAS 91 systems needed improvements. 73 For several reasons, Mr. Gerrity should have 
considered the audit difference material. First and foremost, the size of the difference should 
have been a red flag. Mr. Gerrity has stated that he now would consider a $200 million audit 
difference to be material 74 The reduction in amortization expense also had an important effect 
on executive compensation. It boosted EPS by over 120 per share, and without that boost EPS 
would not have met the minimum needed for an AIP bonus for 1998. 75 That effect on executive 
compensation alone should have been sufficient to deem the difference material, irrespective of 
Fannie Mae's quantitative parameters for determining materiality. 

Even after the FAS 91 audit differences were disclosed to the Audit Committee by Ms. 
Spencer in February 2000, the record fails to show that either Mr. Gerrity or the full Audit 
Committee followed up to confirm that a policy had been implemented or that Mr. Gerrity or the 
Committee questioned KPMG again. Given KPMG's position that Fannie Mae's practices were 

imprecise, reasonable inquiry by the Audit Committee would have exposed the lack of a formal 
policy. In fact, the record fails to show that the Audit Committee members made an effort to 
familiarize themselves with that critical accounting policy before Ms. Spencer made a 
presentation to the Audit Committee in November 2003. 

The Audit Committee failed in its oversight role by not demanding that a formal policy 
for FAS 91 be put in place and that such a policy, when put into place, be endorsed by the 
Financial Standards group of the Enterprise and the external auditor. In doing so, the Committee 
failed to insure the integrity of financial results. The Audit Committee also failed to adequately 
oversee the development of the annual audit plan. Armed with the knowledge of KPMG's audit 
differences in 1998 and 1999 related to amortization of purchase premiums and discounts, the 
Audit Committee had a responsibility to ensure that the Office of Auditing conducted an internal 
audit of that area. Such an audit was not conducted until 2003. 

FAS 133, The Audit Committee had opportunities to question management's implementation of 
FAS 133 but failed in its duty to do so. 

In an Audit Committee update on the FAS 133 effort in April 2000, the minutes of the 
meeting reflect comments of KPMG partner Julie Theobold that KPMG intended to perform a 
significant amount of testing of financial reporting and planning during the year 2000. She 
stated that KPMG's test work would emphasize the system and accounting changes required to 
account for hedges under the new standard. 76 In his February 2001 report to the Board of 



that were determined by management to be immaterial, both individually and in the aggregate, to the financial 
statements taken as a whole. . ." Also See AICPA Practice Alert 94-1: Dealing With Audit Differences, February 
1994. 

73 OFHEO Interview, Julie Theobald, February 16, 2005, pp. 47-48. 

74 Paul Weiss Memorandum of Interview with Thomas Gerrity, March 14, 2006, p. 29. 

75 Mr. Gerrity was unaware that there was a "cliff * built into the AIP targets and, as a result, had no understanding 
of the significance of the audit difference. OFHEO Interview, Thomas Gerrity, March 14, 2006, p. 63. 

76 Audit Committee Minutes, April 18, 2000, p, 5, FMSE 014459-65, 
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Directors, CFO Howard criticized the standard and focused on the effect the standard would 
have on Fannie Mae's financial statements. 77 Minutes of those meetings, however, do not reflect 
any discussion of the principles used to implement FAS 133 at Fannie Mae, the critical decisions 
that the Enterprise made regarding systems development or accounting, or the results of any 
KPMG testing that had preceded implementation. The Audit Committee should have inquired 
about that information in order to gain sufficient understanding to judge whether appropriate 
accounting decisions had been made and effective systems were in place. 

Furthermore, management represented to the Financial Accounting Standards Board 
(FASB) and the financial community in 1999 that a delay in implementing FAS 133 was 
imperative because of the extensive accounting changes the Enterprise was facing when, in fact, 
one of the three major principles of the Enterprise's implementation of FAS 133 was to leverage 
off existing accounting systems. In Mr. Howard's letter to FASB Chairman Edmund Jenkins, 
Mr. Howard emphasized the need for more time to develop new accounting systems to address 
the complex changes that FAS 133 would require. He stated that those changes were further 
complicated because of requirements resulting from year 2000 system changes. 78 Mr. Boyles, 
then Director for Financial Standards, headed a letter-writing campaign with other companies 
and organizations to convince FASB of the need to delay implementation of FAS 133. 79 In 
addition, the Enterprise represented in its financial statements that the delay granted by FASB 
would give the Enterprise "adequate time to build the accounting and management systems 
needed to implement the new standard." 80 The inconsistency between the aggressive lobbying 
efforts to delay the standard and the ability of Fannie Mae to qualify virtually all of its 
derivatives for hedge accounting under the "short cut" method, as described in OFHEO's Report 
of Findings to Date, should have prompted the Audit Committee to explore more closely Fannie 
Mae's implementation of the standard. 

Failure to Investigate Allegations Made by Roger Barnes. Section 301 of the Sarbanes-Oxley 
Act of 2002 (SOX) requires audit committees of companies that register their stock with the 
Securities and Exchange Commission (SEC) to establish procedures for the receipt, retention, 
and treatment of complaints regarding accounting, internal accounting controls, or auditing 
matters; and the confidential, anonymous submission by employees of concerns regarding 
questionable accounting or auditing matters. Further, SOX requires that each audit committee 
shall have the authority to engage independent counsel and other advisers, as it determines 
necessary to carry out its duties. 

As described in Chapter VIII, in October 2003 Roger Barnes, a manager in the Office of 
the Controller, approached Fannie Mae through his lawyer to pursue a settlement of claims of 
discrimination resulting from allegations he had previously raised regarding Fannie Mae's 
amortization policies and earnings management. Fannie Mae entered into a settlement 
agreement with Mr. Barnes on November 3, 2003. Given its responsibilities for regulatory 



79 



77 Board Meeting Minutes, February 20, 2001, pp. 9-1 FMSE 004788-800. 

76 Letter from Timothy Howard to Edmund Jenkins, April 12, 1 999, p. 2 FMSE-SP 074288-90. 

See 1 999 self-assessment by Jonathan Boyles, p. 2, FMSE 698829-33 , 

Quarterly report Q&A excerpt FMSE 417002. 

The Sarbanes-Oxley Act, 107 Pub. L. No. 204, 1 16 Stat 745, July 30, 2002. 
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compliance and investigation of complaints related to accounting, internal controls, and auditing 
matters, the Audit Committee was required to ensure a timely, thorough, and independent 
investigation into Mr. Barnes' allegations. The allegations, and the subsequent settlement 
agreement, should have raised the concern of every member of the Audit Committee, especially 
when considered against the background of the recently released Baker Botts report on Freddie 
Mac's internal investigation and the initiation of the OFHEO special examination. 

The Audit Committee failed to make further inquiries or convene a special investigation 
after being informed at the November 17, 2003 Audit Committee meeting that Fannie Mae had 
reached a settlement with Mr. Barnes. 82 The news of the settlement was received by the Audit 
Committee just three days after the Committee had been convened in order to discuss 
certification of the third quarter financial statements. Fannie Mae settled the case without 
bringing the matter to the Audit Committee and elected to postpone discussion of the matter until 
after the financial statements had been certified. Given that OFHEO had just announced a 
special examination of Fannie Mae's accounting practices, the Audit Committee was on notice 
that such allegations warranted further investigation. At a minimum, the Audit Committee had 
an obligation to ensure that the matter be disclosed to OFHEO. Instead, the matter was ignored 
until February 2004, when it was reviewed as part of the special examination. 

Failure to Question the Assignment of Both Chief Financial Officer and Risk Policy Functions to 
Mr. Howard . In 2000, Mr. Howard became a member of the Office of the Chairman. At that 
time, he also assumed responsibility for all credit and interest rate risk policy functions, 
becoming the equivalent of a chief risk officer for Fannie Mae. That consolidation gave Mr. 

Howard direct responsibility "of all people who either set risk policy or did risk analytics" 83 in 
addition to his core role of overseeing financial and accounting policy as CFO. 

As discussed in Chapter VIII, the risk assessment function should be independent from 
the accounting and reporting functions to assure the fullest exchange of views. Consolidation 
removes an important control. It creates an environment in which mistakes and inappropriate 
manipulation may go unchecked as financial reporting results can easily be affected or 
manipulated by the views of the individual with accounting oversight. The assignment of 
responsibility for risk policy issues to Mr. Howard should not have been permitted by the Audit 
Committee or the Board, Fannie Mae's own research found no other peer company having a 
CFO also serving as CRO. 84 

With the reassignment of Adolfo Marzol, the Chief Credit Officer, in 2004, power was 
further consolidated as Mr. Howard assumed Mr. Marzol's duties as well. With that move, 
another source of internal control was removed. Upon the announcement of Mr, Howard 
increased duties, Board member Ashley voiced his displeasure with management, yet no steps 
were taken to remedy the situation. 85 The record shows no indication of Audit Committee 



82 The November 17, 2003, meeting is also the meeting that contained a presentation by Ms. Spencer regarding the 
critical accounting policy for FAS 91 . See Audit Committee Meeting Minutes at FMSE 504796-805. 

83 OFHEO Interview, Timothy Howard, August 5, 2004, p. 7. 

8 " E-mails between Jill Blickstein and Rebecca Senhauser, August 12, 2004, FM SRC OFHEO 00713573-74. 

83 E-mail from Daniel Mudd to Franklin Raines with copies to Timothy Howard, Thomas Donilon and Jill 

Blickstein, August 10, 2004, FMSE-E KD0048713. 
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involvement or inquiry. Oversight of the risk management function should have been performed 
by the Audit Committee by way of the Office of Auditing, according to Fannie Mae's interna] 
audit charter. The record does not show that the Audit Committee reviewed and approved or had 
any of the required involvement in the consolidation of powers and responsibilities in Mr, 
Howard, Consequently, the Audit Committee failed in its oversight responsibilities and allowed 
an inappropriate consolidation of risk and financial accounting and reporting to occur. 

Failure to Adequately Oversee Sarbanes-Oxlev Section 404 Compliance Implementation . 
Chapter VII describes the decision of Fannie Mae management to assign responsibility for 
Sarbanes-Oxley (SOX) 404 compliance to the Office of Auditing and the inadequacy of the 
resources of that office relative to the task. Ultimately, the Office was diverted from performing 
its core functions and was unable to perform its new functions. 86 

The Audit Committee is responsible for the budget and staffing of the Office of Auditing, 
the establishment of the annual audit plan, and evaluation of any restrictions or limitations placed 
on that office, 87 Thus, the members should have been aware of the heavy workload placed upon 
the Office of Auditing and the inadequacy of its resources. In April 2004, the Audit Committee 
was presented with an opportunity to address the staffing limitations that resulted from SOX 
activities. In contrast to previous years, the Audit Plan for 2004 only scheduled 54 internal 
audits, compared with an average of 120 audits performed in past years 88 That reduction should 
have been a clear indication to the Committee that resources in the Office were stressed. While 
the Audit Committee inquired as to what more could be accomplished were the Office of 
Auditing to receive additional resources, the Committee fell short by approving an abbreviated 
Audit Plan and authorizing only temporary contract employees to assist in technical writing and 
flowcharting. 89 

Even assuming that the Audit Committee possessed a positive view of the Office of 
Auditing, the importance of ensuring Fannie Mae's SOX compliance required that it obtain 
sufficient information as to how those SOX responsibilities at Fannie Mae would be carried out. 
There is no indication of any discussion, let alone debate, in any of the Board Minutes or Audit 
Committee minutes that OFHEO reviewed. Rather, it appears that Fannie's Mae's management 
assigned those new responsibilities to the Office of Auditing without any meaningful Audit 
Committee participation. 

Oversight of the Independent Auditor . As described in Chapter VII, KPMG improperly provided 
unqualified opinions on financial statements that contained significant departures from GAAP. 
The Audit Committee failed to oversee the independent audit function of the Enterprise as 
required by OFHEO guidance and regulation. In addition, the Audit Committee missed critical 
opportunities for meaningful inquiry into KPMG's audit activities associated with Fannie Mae's 



86 Memorandum from Kathryn Rock to Robert Levin, "Management's 2004 Assessment of Internal Control over 
Financial Reporting," August 12, 2005, FMSE 519599-616, at 606, where PricewaterhouseCoopers (PWC) 
identified hundreds of potential control problems that the Office of Auditing had not identified in 2004. 

87 2003 Fannie Mae Audit Committee Charter. FMSE 504223 - 228, 

88 See Head Count Request for 3 FTE in 2003, FMSE-IR 284780-781, and Office of Auditing and KPMG Joint 
Audit Plan 2004. 

89 See Audit Committee Meeting Minutes, April 19, 2004, pp. 2-3, FMSE-SP 082060 - 68. 
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implementation of critical accounting estimates and significant accounting policies that may 
have revealed deficiencies in the independent audit program. Instead, as confirmed by Mr, 
Gerrity, the Audit Committee passively waited for KPMG to raise issues to the Audit 
Committee. 90 

The Audit Committee also failed to inquire about the work KPMG performed, or failed to 
perform, to determine that Roger Barnes' allegations regarding Fannie Mae*s amortization 
accounting were without merit. Had the Audit Committee questioned KPMG, they would have 
learned that KPMG had not performed sufficient review or test work to make a determination 
about the merits of Barnes accounting allegations and that KPMG audit partners had 
misrepresented their position to Fannie Mae staff, to Mr, Barnes, and to the Audit Committee, 

As shown in Table IX- 1, the fees that Fannie Mae paid its independent auditor for audit 
related work accounted for a small fraction of the total fees KPMG received annually from the 
Enterprise. 



Table IX- 1 


Fees paid to KPMG by Fannie IV 


[ae, 2000-2003 


91 


Year 


Audit Fees 


Other Fees 


Total Fees 


Audit as 

Percent of Total 


1998 y2 


$ 760,000 


$8,000,000 


$ 8,760,000 


9 


1999* 


$810,000 


$6,879,000 


$ 7,689,000 


11 


2000 


$1,199,000 


$6,610,000 


$7,809,000 


15 


2001 


$1,402,200 


$6,774,036 


$8,176,236 


17 


2002 " 


$1,978,955 


$7,511,478 


$9,490,433 


21 


2003 


$2,721,300 


$8,254,807 


$10,976,107 


25 



The increase in audit fees from 9 percent of total fees in 1998 to 25 percent of total fees m 2003 
reflects, at least in part, the sharp increase in the number and complexity of accounting policies 
and practices that the Enterprise had to adopt during that time-frame and dramatic growth in the 

Enterprise's portfolio business. 94 Furthermore, lower fees before 2002 reflect the fact that 



90 OFHEO Interview, Thomas Gerrity, March 14, 2006, p. 34, 

9 ' Fannie Mae Notice of Annual Meeting of Shareholders, 1998; Fannie Mae Notice of Annual Meeting of 

Shareholders, March 29, 1999; Fannie Mae Notice of Annual Meeting of Shareholders, March 27, 2000; Faonie Mae 

Notice of Annual Meeting of Shareholders, April 2, 2001; Fannie Mae Notice of Annual Meeting of Shareholders, 

April 2, 2002; Fannie Mae Notice of Annual Meeting of Shareholders, April 14, 2003; Fannie Mae Notice of Annual 

Meeting of Shareholders, April 14, 2003; Fannie Mae Notice of Annual Meeting of Shareholders, April 23, 2004, 

Other Fees include fees related to REM1C pricing, closing and validation services,. due diligence on multifamily 

loans, assistance on regulatory matters, and tax services. 

92 KPMG Peat Marwick Trend Analysis Economic Indicators and Audit Fees, KPMG-OFHEO-1 75801; Fannie 

Mae presentation, "Discussion of the 1998 Audit,'* February 16, 1999, p. 7, FMSE 014347-014356 at 353. 

n Letter from KPMG to the Audit Committee, February 9, 2000, FMSE 014701 . 

94 Between 1998 and 2004, the Enterprise implemented, among others, the following accounting statements, 

guidelines, and pronouncements: FAS 133 Accounting for Derivative Instruments and Hedging Activities; FAS 140 

Accounting for Transfers and Services of Financial assets and Extinguishment of Liabilities-a Replacement of 

FASB Statement 125; FAS 148 Accounting for Stock-Based Compensation Transition and Disclosure - An 

Amendment to FASB Statement 123; FAS 149 Amendment of Statement 133; FAS 150 Accounting for Certain 

Financial Instruments with Characteristics of Both Liabilities and Equity; Emerging Issues Task Force Issue 99-20 
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Fannie Mae was not an SEC registrant, For KPMG, Fannie Mae, as one of the largest financial 

institutions in the country, was a prestigious client; however, the audit engagement was a minor 
part of the relationship. 

One of the primary functions of the Audit Committee is to oversee the engagement of the 
outside auditors. Over the period covered by this report, that role required the Audit Committee 
to become increasingly engaged with the outside auditor so it could make knowledgeable, 
thoughtful, and probing inquiries. Such inquiries are necessary for the Audit Committee to 
understand the scope and quality of the independent audit work for which they have contracted 
and to assure the Board that the Enterprise's financial statements present fairly its' financial 
condition and are prepared in accordance with GAAP. The Committee's failure to adequately 
perform this role contributed to the unsafe and unsound practices of the Enterprise, 

Compensation Committee 

The duties and responsibilities of the Compensation Committee of the Board of Directors of 
Fannie Mae (Compensation Committee) are set forth in the Compensation Committee Charter, 
and OFHEO regulations and guidance, 95 which incorporate the listing standards of the New 
York Stock Exchange (NYSE) and applicable safety and soundness standards. 96 The primary 
role of the Compensation Committee is to "discharge the responsibilities of the Board relating to 
compensation of Fannie Mae executives/' 97 which is achieved principally by overseeing and 
advising the Board on the adoption of policies governing Fannie Mae's annual compensation and 
stock ownership plans. The Committee is also responsible for producing the annual report on 
executive compensation that is included in the Enterprise's annual proxy statement. In 
accordance with both the Safety and Soundness Act and the Charter Act, Fannie Mae is only 
authorized to pay compensation that is reasonable and comparable with, compensation for 
employment in similar businesses involving similar duties. 98 Section 309(d)(2) of the Charter 
Act also requires that a "significant portion of the compensation of all executive officers. . . shall 



Recognition of Interest Income and Impairment on Purchas and Retained Beneficial Interest in Securitized 
Financial Assets; Statement of Position 01-0 Accounting for certain Entities (including Entities with Trade 
Receivables) That Lend To or Finance the Activities of Others; FIN 45 Guarantor Accounting and Disclosure 
Requirements for Guarantees, Including Indirect Guarantees of Indebtedness of Others - An Interpretation of FASB 

Statements N5, 57, and 107 and Rescission of FASB Interpretation No. 34; and Consolidation of Variable Interest 
Entities- An Interpretation of ARB No. 51. 

95 12 CFR §§ 1710.12(c)(2), 1720 and Appendix A to Part 1720 - Policy Guidance-Minimum Safety and 
Soundness Requirements. 

96 See also Schwartz, B. and Goodman, A. L., "Corporate Governance: Law and Practice, Chapter 10: The 
Compensation Committee," § 10,01 (2005) (Corporate Governance Law & Practice). The 1992 adoption of federal 
securities regulations requiring proxy statement disclosures about executive compensation and the enactment in 
1993 of section I62(m) of the Internal Revenue Code, which eliminated the corporate income tax deduction for 
compensation over $ImiIIion paid to the CEO and other four most highly compensated executive officers (the so- 
called "Named Executive Officers"), also have substantively affected the responsibilities of compensation 
committees. 

97 Compensation Committee Charter, set forth by resolution in the Meeting Minutes of the Nominating and 
Corporate Governance Committee, dated January 20, 2003. See FMSE 505379, 505390-392, 

98 See 12 U.S.C. § 4518 and 12 TJ.S.C. § 1723a(d)(2), respectively. 
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